You might also want to keep in mind if some versions of
Outlook are being
used to generate these spams, you could start seeing just
a winmail.dat
attachment. This would indicate a message was generated in
RTF (rich text
format). See: